aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMike Pall <mike>2024-07-03 21:42:21 +0200
committerMike Pall <mike>2024-07-03 21:42:21 +0200
commit811c5322c8ab6bdbb6784cd43aa57041a1cc9360 (patch)
tree44cd97a1d4dd20d5466cf0cb2e1ad4cb19a7a162
parent4a22050df9e76a28ef904382e4b4c69578973cd5 (diff)
downloadluajit-811c5322c8ab6bdbb6784cd43aa57041a1cc9360.tar.gz
luajit-811c5322c8ab6bdbb6784cd43aa57041a1cc9360.tar.bz2
luajit-811c5322c8ab6bdbb6784cd43aa57041a1cc9360.zip
Handle partial snapshot restore due to stack overflow.
Reported by pwnhacker0x18. Fixed by Peter Cawley. #1196
-rw-r--r--src/lj_debug.c9
-rw-r--r--src/lj_trace.c4
2 files changed, 9 insertions, 4 deletions
diff --git a/src/lj_debug.c b/src/lj_debug.c
index bca1d7a5..abb7572c 100644
--- a/src/lj_debug.c
+++ b/src/lj_debug.c
@@ -102,9 +102,12 @@ static BCPos debug_framepc(lua_State *L, GCfunc *fn, cTValue *nextframe)
102 pos = proto_bcpos(pt, ins) - 1; 102 pos = proto_bcpos(pt, ins) - 1;
103#if LJ_HASJIT 103#if LJ_HASJIT
104 if (pos > pt->sizebc) { /* Undo the effects of lj_trace_exit for JLOOP. */ 104 if (pos > pt->sizebc) { /* Undo the effects of lj_trace_exit for JLOOP. */
105 GCtrace *T = (GCtrace *)((char *)(ins-1) - offsetof(GCtrace, startins)); 105 if (bc_isret(bc_op(ins[-1]))) {
106 lua_assert(bc_isret(bc_op(ins[-1]))); 106 GCtrace *T = (GCtrace *)((char *)(ins-1) - offsetof(GCtrace, startins));
107 pos = proto_bcpos(pt, mref(T->startpc, const BCIns)); 107 pos = proto_bcpos(pt, mref(T->startpc, const BCIns));
108 } else {
109 pos = NO_BCPOS; /* Punt in case of stack overflow. */
110 }
108 } 111 }
109#endif 112#endif
110 return pos; 113 return pos;
diff --git a/src/lj_trace.c b/src/lj_trace.c
index d015f2ab..8385f3d1 100644
--- a/src/lj_trace.c
+++ b/src/lj_trace.c
@@ -788,8 +788,10 @@ int LJ_FASTCALL lj_trace_exit(jit_State *J, void *exptr)
788 exd.J = J; 788 exd.J = J;
789 exd.exptr = exptr; 789 exd.exptr = exptr;
790 errcode = lj_vm_cpcall(L, NULL, &exd, trace_exit_cp); 790 errcode = lj_vm_cpcall(L, NULL, &exd, trace_exit_cp);
791 if (errcode) 791 if (errcode) {
792 setcframe_pc(cframe_raw(L->cframe), L); /* Point to any valid memory. */
792 return -errcode; /* Return negated error code. */ 793 return -errcode; /* Return negated error code. */
794 }
793 795
794 lj_vmevent_send(L, TEXIT, 796 lj_vmevent_send(L, TEXIT,
795 lj_state_checkstack(L, 4+RID_NUM_GPR+RID_NUM_FPR+LUA_MINSTACK); 797 lj_state_checkstack(L, 4+RID_NUM_GPR+RID_NUM_FPR+LUA_MINSTACK);